{"id":"CVE-2021-33632","aliases":["EUVD-2021-20309","GHSA-mrfq-6jmf-4q53","OESA-2024-1287","OESA-2024-1289","OESA-2024-1290","OESA-2024-1307"],"status":"published","title":"TOCTOU Race Condition problem in iSulad","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.\n\nThis issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00146,"percentile":0.03859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:19Z","fixes":[{"ecosystem":"openEuler:22.03-LTS","package":"iSulad","fixed_in":["2.0.18-16.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"iSulad","fixed_in":["2.1.5-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"iSulad","fixed_in":["2.0.18-16.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"iSulad","fixed_in":["2.0.18-17.oe2003sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"iSulad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.18-16.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"iSulad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"iSulad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.18-16.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"iSulad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.18-17.oe2003sp4"}]}]}],"products":[{"vendor":"openeuler","product":"isula"},{"vendor":"openeuler","product":"isulad"}],"references":[{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1307","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1287","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1290","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1289","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/iSulad/pulls/645","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/iSulad/pulls/640","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/iSulad/pulls/639","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33632","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mrfq-6jmf-4q53"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1287","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1289","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1290","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1307","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-33632","title":"TOCTOU Race Condition problem in iSulad","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.\n\nThis issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.\n\n","status":"published","published":"2024-03-25T06:59:42.307Z","modified":"2024-08-03T23:58:21.422Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-20309","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.\n\nThis issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.\n\n","status":"published","published":"2024-03-25T06:59:42Z","modified":"2024-08-03T23:58:21Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:33.866739Z"}],"ghsa":[{"id":"GHSA-mrfq-6jmf-4q53","title":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux...","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.\n\nThis issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.\n\n","status":"published","published":"2024-03-25T09:32:33Z","modified":"2024-03-25T09:32:33Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:55:43.067988Z"}],"nvd":[{"id":"CVE-2021-33632","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C.\n\nThis issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.\n\n","status":"published","published":"2024-03-25T07:15:49.63Z","modified":"2026-06-17T03:54:54.21Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:07:08.163458Z"}],"osv":[{"id":"OESA-2024-1287","title":"iSulad security update","description":"This is a umbrella project for gRPC-services based Lightweight Container Runtime Daemon, written by C.\r\n\r\nSecurity Fix(es):\r\n\r\n在isulad服务初始化阶段，会进行临时文件的正确性检查，如果检查不通过则重新创建文件，在检查与创建之间，存在一个条件竞争问题，攻击者可以通过利用该漏洞进行提权。(CVE-2021-33632)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:18.370897598Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1289","title":"iSulad security update","description":"This is a umbrella project for gRPC-services based Lightweight Container Runtime Daemon, written by C.\r\n\r\nSecurity Fix(es):\r\n\r\n在isulad服务初始化阶段，会进行临时文件的正确性检查，如果检查不通过则重新创建文件，在检查与创建之间，存在一个条件竞争问题，攻击者可以通过利用该漏洞进行提权。(CVE-2021-33632)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:18.359020016Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1290","title":"iSulad security update","description":"This is a umbrella project for gRPC-services based Lightweight Container Runtime Daemon, written by C.\r\n\r\nSecurity Fix(es):\r\n\r\n在isulad服务初始化阶段，会进行临时文件的正确性检查，如果检查不通过则重新创建文件，在检查与创建之间，存在一个条件竞争问题，攻击者可以通过利用该漏洞进行提权。(CVE-2021-33632)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:18.370884061Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1307","title":"iSulad security update","description":"This is a umbrella project for gRPC-services based Lightweight Container Runtime Daemon, written by C.\r\n\r\nSecurity Fix(es):\r\n\r\n在isulad服务初始化阶段，会进行临时文件的正确性检查，如果检查不通过则重新创建文件，在检查与创建之间，存在一个条件竞争问题，攻击者可以通过利用该漏洞进行提权。(CVE-2021-33632)","status":"published","published":"2024-03-22T11:06:45Z","modified":"2026-08-18T01:18:19.430859085Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"}]}}